Is CFCA CryptoKit.Paperless.WEGO Extension safe?

CFCA CryptoKit.Paperless.WEGO Extension forwards page-supplied native host names and data to a local smart-card app without validation.

This extension bridges wegoleasing.com web pages to a local native application used for smart-card signing of paperless lease documents. It exposes an onMessageExternal handler that reads the native messaging host name and message payload directly from the calling page's request, then passes them to chrome.runtime.connectNative and sendNativeMessage without checking the host name against a fixed, expected value or validating the payload's contents.

Part of this rating comes from analysis signals we haven't published as detailed findings yet.